The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The shell script ralph.sh invokes the AI agent CLI using the --dangerously-skip-permissions flag. This flag is designed to bypass security guardrails and confirmation prompts, allowing the autonomous agent to execute arbitrary commands, modify files, and perform network operations without user oversight or approval.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits significant vulnerability to indirect prompt injection through several vectors:
Ingestion Points: The script ralph.sh reads project descriptions from prd.json files and interpolates them directly into a prompt in the find_next_project function to have the AI select the next task. Additionally, the agent instructions in references/prompt.md direct the agent to read prd.json and .ralph-progress.txt as authoritative sources for its tasks.
Boundary Markers: There are no boundary markers or instructions to treat data in prd.json or .ralph-progress.txt as untrusted. Malicious instructions embedded in these files could override the agent's system prompt.
Capability Inventory: The agent has the capability to execute shell commands (via tests/lints), modify any file in the worktree, and perform git/GitHub operations (git push, gh pr create).
Multi-step Chains: The agent is instructed to write "learnings" into AGENTS.md and .ralph-progress.txt. A compromised agent could use this to persist malicious instructions that would influence future iterations of itself or other agents working in the same codebase.
[COMMAND_EXECUTION]: The skill facilitates autonomous command execution by instructing the agent to run "quality checks" such as typecheck, lint, and test. While these are standard development tasks, when combined with the permission bypass and injection vulnerabilities, they provide a direct path for an attacker to execute arbitrary code in the host environment.

ralph-json-start-loop